Cybersecurity · 5 views

New TrickMo Variant Uses TON C2 and SOCKS5 to Create Android Network Pivots

Cybersecurity researchers have flagged a new version of the TrickMo Android banking trojan that uses The Open Network (TON) for command-and-control (C2).

Source The Hacker News AI Summary Updated May 12, 2026

Story intelligence Beta

Freshness Stale Updated May 12, 2026

Confidence Limited Single-outlet story

Coverage Single outlet

Views 5 Community interest

Read time 1 min ~55 words

AI Summary

Cybersecurity researchers have flagged a new version of the TrickMo Android banking trojan that uses The Open Network (TON) for command-and-control (C2). The new variant, observed by ThreatFabric between January and February 2026, has been observed actively targeting banking and cryptocurrency wallet users in France, Italy, and Austria. "TrickMo relies on a runtime-loaded APK (dex.module),

Read full article on The Hackernews

AI summaries can be wrong sometimes—always verify important details using the source article.